pi-condense 2.13.1 → 2.15.0

package/CHANGELOG.md

@@ -7,6 +7,24 @@ Published to npm as [`pi-condense`](https://www.npmjs.com/package/pi-condense) (
 Pushing a `vX.Y.Z` tag triggers `.github/workflows/release.yml`, which runs the tests and
 publishes via OIDC trusted publishing. See `.agents/skills/release/SKILL.md`.
 
+## [2.15.0] - 2026-11-09
+
+### Changed
+
+- pi-condense treats sessions without a UI (`pi -p`, `--mode json`, an SDK host with no UI context) as single-prompt and skips the final `agent-message` flush: a single-prompt print child has no later call to read the pruned context. Multi-message print runs and headless SDK hosts still rely on budget, delta, and frontier-gap flushes at `turn_end` (`autoBudgetThreshold`, `budgetTurnDelta`, `frontierGapThresholdTokens`); pending work stays recoverable through the reload rearm. (#29)
+
+## [2.14.0] - 2026-11-08
+
+### Changed
+
+- The compiled-against pi packages (`@earendil-works/pi-ai`, `pi-coding-agent`, `pi-tui`) move from `^1.3.0` to `^1.5.0`; the runtime floor stays pi >= 1.3.0 (`streamSimple`).
+
+### Added
+
+- Protected tool names and path globs also cover a result's recorded nested calls, including reads inside codemode scripts. Incomplete nested-call records keep the whole result inline verbatim even above the spill threshold and with path matching disabled; protected scripted reads are not superseded by later reads of the same path. (#27)
+- Paid synthetic behavioral evals measure downstream context quality after summarization and pruning, with frozen committed baselines for both summarizers and an eval-needed decision gate for every repository change. Offline harness tests remain separate from paid runs. (#22)
+- A private-session replay harness (`npm run eval:replay`) rebuilds real tool-call batches from session files into a corpus outside every checkout, summarizes each with production and a `--candidate` module, scores both against strings the assistant later reused, and fails on regressions; `matrix` compares model x thinking cells on retention, latency and cost. Synthetic eval reports now count evidence retained in the summary separately from evidence recovered on demand. (#23)
+
 ## [2.13.1] - 2026-10-22
 
 ### Changed

package/PRUNING.md

@@ -633,15 +633,17 @@ Implementation: `src/pruner.ts` `pruneMessages(messages, indexer)` returns `{ me
 
 ### Protected tools & paths
 
-A tool call is protected if **either** its `toolName` is in `protectedTools` **or** its `args.path` (string) matches any glob in `protectedPaths`. Protected calls are filtered out **at capture time** - they never enter the `pendingBatches` queue, so their raw `ToolResultMessage` stays verbatim in future LLM context until a later read of the same path covers its delivered lines and supersedes it (below).
+A tool call is protected if its `toolName` is in `protectedTools`, its `args.path` (string) matches any glob in `protectedPaths`, or its result's recorded nested calls (`nestedCalls.calls`) include a name or path matching the same rules. This covers reads made inside codemode scripts and any other tool carrying `nestedCalls`, without a tool-name restriction. An incomplete nested-call record (`nestedCalls.complete === false`) protects the whole result unconditionally, even with both configuration lists empty. The recorder marks a record incomplete when arguments exceed 8 KiB per call or 32 KiB total, calls exceed 256, or a call is still running when the script ends; even a script that reads nothing protected can therefore stay verbatim. Nested call status does not affect matching.
+
+Protected calls are filtered out **at capture time** - they never enter the `pendingBatches` queue, summarizer, new index entries, or oversized spill, so their raw `ToolResultMessage` stays inline verbatim even above `spillThreshold`. Inside newly compressed chains their outputs relocate verbatim as `<protected-output>` without blocking compression. Only direct reads can be superseded when a later read of the same path covers their delivered lines and the cadence gate allows it (below); a protected scripted read stays verbatim and is not stubbed by a later read of the same path.
 
 **`protectedTools: string[]`** (default `[]`) - allowlist of tool names. Covers tools whose output is a small handle that must be reused byte-for-byte (e.g. a session-id) or planning tools like `todowrite` / `todoread`.
 
-**`protectedPaths: string[]`** (default `["**/skills/**/*.md", "**/gauntlet-overrides.md"]`) - glob list matched against `args.path`. Designed for skill files that carry multi-step workflow gates; summarizing them is categorically lossy. Non-string or missing `path` arguments never match. Set `[]` to disable. Edit with `/pruner protected-paths`.
+**`protectedPaths: string[]`** (default `["**/skills/**/*.md", "**/gauntlet-overrides.md"]`) - glob list matched against direct and recorded nested `args.path`. Designed for skill files that carry multi-step workflow gates; summarizing them is categorically lossy. Non-string or missing `path` arguments never match. Set `[]` to disable path matching only; nested tool-name matches and incomplete-record protection remain active. Edit with `/pruner protected-paths`.
 
 Glob contract: full-path match against the raw `args.path` string with `\` normalized to `/`. `*` and `?` match within a segment (no `/`); `**` crosses segments; `**/` also matches zero directories (so `**/SKILL.md` matches a bare relative `SKILL.md`). Case-sensitive. All other characters are regex-escaped literals.
 
-**Render-time re-check:** stub replacement runs in-flight on every turn (`pruneMessages`). If a tool call's persisted `args` now satisfy `isProtected` (e.g. a pattern was added mid-session), the stub is skipped and the raw result is left verbatim - this repairs already-summarized records in existing sessions with no schema change. Declared limitation: records inside already-compressed chains (`context-prune-chain` entries) are NOT repaired - their `protectedToolCallIds` set is fixed at compression time (forward-only). Dedup-alias edge: an alias resolving to an unprotected original stays stubbed.
+**Render-time re-check:** stub replacement runs in-flight on every turn (`pruneMessages`). If a tool call's persisted name and `args`, or its live result's `nestedCalls`, now satisfy `isProtected` (e.g. a pattern was added mid-session or a scripted read was summarized before nested-call protection), the stub is skipped and the raw result is left verbatim. The stored index entry stays but is not applied; this repairs already-summarized records in existing sessions with no schema change. Declared limitation: records inside already-compressed chains (`context-prune-chain` entries) are NOT repaired - their `protectedToolCallIds` set is fixed at compression time (forward-only). Dedup-alias edge: an alias resolving to an unprotected original stays stubbed unless its own live result carries protecting `nestedCalls`, and its own `args.path` is not re-checked.
 
 **Supersession (phase 1b, `src/supersede.ts`):** protected calls are never indexed, so content-hash dedup never sees them. A paired occurrence participates only when `isProtected(toolName, args)` is true and `typeof args.path === "string"`. Occurrences group by normalized `args.path` (backslash -> slash). An earlier occurrence is a supersession candidate only when **any later occurrence** of that path covers its delivered line range, not just when the last occurrence covers it. Different paths never interact; disjoint chunks stay verbatim.
 
@@ -973,7 +975,7 @@ Any other outcome - zero or multiple matches on either boundary, `finalAssistant
 - With K=3: the three most-recently-closed chains stay as-is; the fourth triggers compression of the oldest. Exactly K closed chains are kept raw (the open/live chain is never counted).
 - `/pruner compact` bypasses the window and compresses every eligible chain immediately (retroactive).
 
-**Closing-message threading.** In agent-message mode the flush runs from `message_end`, which pi emits to extensions *before* it persists the message to the session (`agent-session.js` runs `_emitExtensionEvent` ahead of `sessionManager.appendMessage`). So at flush time `getBranch()` is missing the just-closed final assistant, and the newest chain would read as open — over-retaining by one (effective K+1). `index.ts` threads the triggering `event.message` through `FlushOptions.closingMessage` into `withClosingMessage` so the chain closes and the window is exactly K.
+**Closing-message threading.** pi-condense treats `ctx.hasUI === false` sessions (`pi -p`, `--mode json`, an SDK host with no UI context) as single-prompt and skips the final agent-message flush: a single-prompt print child has no later call to read the pruned context. Multi-message print runs and headless SDK hosts still rely on the `turn_end` budget/delta/frontier-gap triggers (`autoBudgetThreshold`, `budgetTurnDelta`, `frontierGapThresholdTokens`) for pruning. In sessions with a UI, the agent-message flush runs from `message_end`, which pi emits to extensions *before* it persists the message to the session (`agent-session.js` runs `_emitExtensionEvent` ahead of `sessionManager.appendMessage`). So at flush time `getBranch()` is missing the just-closed final assistant, and the newest chain would read as open - over-retaining by one (effective K+1). `index.ts` threads the triggering `event.message` through `FlushOptions.closingMessage` into `withClosingMessage` so the chain closes and the window is exactly K.
 
 ### Synthetic message format
 

package/README.md

@@ -69,7 +69,7 @@ pi install npm:pi-condense
 | `agent-message` (default) | When the agent sends a final text-only reply | ~1 cache rewrite per task batch |
 | `on-demand` | Only when you run `/pruner now` | None until you ask |
 
-With the default `agent-message` trigger (and `autoBudgetThreshold`/`budgetTurnDelta` unset), a non-interactive (`pi -p`) session sees its first flush only at the final reply - set `autoBudgetThreshold` (e.g. `0.8`) so flushes also fire mid-run. This is a property of single-prompt sessions, not a defect in the default.
+pi-condense treats a session without a UI (`pi -p`, `--mode json`, an SDK host with no UI context) as single-prompt and skips the final `agent-message` flush there: for a single-prompt `-p` / `--mode json` child, nothing reads the pruned context afterwards. A multi-message print run or a headless SDK host that wants its final messages pruned still relies on the `turn_end` budget/delta/frontier-gap flushes: set `autoBudgetThreshold` (e.g. `0.8`), `budgetTurnDelta`, or `frontierGapThresholdTokens` to enable them. Pending work stays recoverable through the reload rearm if the session is resumed.
 
 Before any summarizer call, a pre-flush pipeline can drop or redirect a batch at zero LLM cost: protected tools/paths are never touched, content-hash duplicates are aliased to the original, batches too small to be worth summarizing are skipped outright, and oversized single results are spilled straight to a sidecar file. Closed tool-call chains older than a rolling window are additionally range-compressed. Full pipeline and each safeguard: [PRUNING.md § Pre-flush Pipeline & Safeguards](PRUNING.md#pre-flush-pipeline--safeguards), [§ Chain Compression](PRUNING.md#chain-compression).
 
@@ -172,7 +172,7 @@ Settings live under `contextPrune` in `<agent-dir>/settings.json` (`$PI_CODING_A
 | `autoBudgetThreshold` | `null` | Fraction (e.g. `0.8`) of the context window that force-flushes everything regardless of `pruneOn`; the trigger point is capped at 300k tokens |
 | `frontierGapThresholdTokens` | `null` | Opt-in absolute-token flush trigger: fires at `turn_end` once the un-pruned tail past the prune frontier reaches N tokens, regardless of window size; recommended starting value `80000` |
 | `maxImagesPerRequest` | `null` | Once a request carries more than N images, the oldest become a text note (in cache-friendly steps of half of N) so a long session stays under a provider's per-request image limit; applies even with pruning off. `null` = built-in limit for the model's API (Anthropic Messages: 100; others: no cap); a number overrides it for every API |
-| `protectedTools` / `protectedPaths` | `[]` / `["**/skills/**/*.md", "**/gauntlet-overrides.md"]` | Tool names / path globs that are never summarized; only the newest read per protected path stays verbatim (older reads of the same path are stubbed once the prompt cache is cold anyway) |
+| `protectedTools` / `protectedPaths` | `[]` / `["**/skills/**/*.md", "**/gauntlet-overrides.md"]` | Tool names / path globs that bypass summarization, including reads made inside codemode scripts through the result's recorded nested calls (`nestedCalls`). A protected scripted read stays verbatim and is not stubbed by a later read of the same path; only direct reads can supersede earlier reads when their delivered lines cover them and the cache-rewrite cadence allows it. An incomplete nested-call record (over 8 KiB of arguments per call, 32 KiB total, 256 calls, or a call still running when the script ends) keeps the whole result inline verbatim regardless of `protectedPaths`, even above `spillThreshold`. `protectedPaths: []` disables path matching only |
 | `spillThreshold` | `65536` | Chars above which a single oversized result spills straight to a sidecar file |
 
 The default also protects reads of [pi-gauntlet](https://github.com/jjuraszek/pi-gauntlet)'s per-repo `gauntlet-overrides.md` so the repo's harness contract stays available for gate decisions after pruning.
@@ -191,6 +191,8 @@ No committed roadmap beyond what's already tracked in [CHANGELOG.md](CHANGELOG.m
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) - issues follow a Context / Problem / Idea / Acceptance Criteria template; PRs run the [pi-gauntlet](https://github.com/jjuraszek/pi-gauntlet) workflow (one-liners exempt from ceremony, never from keeping docs truthful).
 
+For paid synthetic context-quality checks and retained behavioral baselines, see the [behavioral eval guide](eval/README.md).
+
 ## Support
 
 If this saves you tokens, [buy me a coffee](https://buymeacoffee.com/jjurasszek).

package/index.ts

@@ -13,6 +13,7 @@
  * Usage:  pi -e .
  */
 
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
 import type { ExtensionAPI, SessionEntry } from "@earendil-works/pi-coding-agent";
 import { loadConfig } from "./src/config.js";
 import { capImages, imageLimitFor } from "./src/image-cap.js";
@@ -62,7 +63,7 @@ export default function (pi: ExtensionAPI) {
     value: { ...DEFAULT_CONFIG },
   };
 
-  const protectionPredicate = (name: string, args: unknown) => isProtected(name, args, currentConfig.value);
+  const protectionPredicate = (name: string, args: unknown, nested?: NestedToolCalls) => isProtected(name, args, currentConfig.value, nested);
 
   // Shared indexer — rebuilt from session on every session_start / session_tree
   const indexer = new ToolCallIndexer();
@@ -926,7 +927,7 @@ export default function (pi: ExtensionAPI) {
       // CapturedBatch is pruned, which is exactly what we want.
       const filtered = {
         ...capturedBatch,
-        toolCalls: capturedBatch.toolCalls.filter((tc) => !isProtected(tc.toolName, tc.args, currentConfig.value)),
+        toolCalls: capturedBatch.toolCalls.filter((tc) => !protectionPredicate(tc.toolName, tc.args, tc.nestedCalls)),
       };
 
       // Eager spill: offload oversized single results to sidecar files before they
@@ -1020,9 +1021,13 @@ export default function (pi: ExtensionAPI) {
   // finished using the raw tool results. flushPending captures the SessionManager
   // before awaiting summarization so print-mode shutdown cannot invalidate the
   // persistence path while the summarizer model is running.
+  //
+  // No-UI sessions are treated as single-prompt to avoid a final prune print children never read.
+  // Multi-prompt print/SDK hosts rely on turn_end budget/delta/frontier-gap triggers instead.
   pi.on("message_end", async (event, ctx) => {
     if (!currentConfig.value.enabled) return;
     if (currentConfig.value.pruneOn !== "agent-message") return;
+    if (ctx.hasUI === false) return;
     if (!isFinalAssistantMessage(event.message)) return;
     await flushPending(ctx, { delivery: "session", closingMessage: event.message, trigger: "message-end" });
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-condense",
-  "version": "2.13.1",
+  "version": "2.15.0",
   "description": "Pi coding-agent extension that summarizes completed tool-call batches, replaces raw outputs with short stubs, compresses closed tool-call chains, and recovers any original on demand via context_tree_query.",
   "author": "Jacek Juraszek",
   "license": "MIT",
@@ -38,7 +38,10 @@
   ],
   "scripts": {
     "check:agents-core": "node scripts/check-agents-core.mjs",
-    "test": "bun test src/"
+    "test": "bun test src/",
+    "eval": "bun eval/run.ts",
+    "eval:replay": "bun eval/replay/run.ts",
+    "test:eval": "bun test eval/"
   },
   "pi": {
     "extensions": [
@@ -57,9 +60,9 @@
     "@sinclair/typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^1.3.0",
-    "@earendil-works/pi-coding-agent": "^1.3.0",
-    "@earendil-works/pi-tui": "^1.3.0",
+    "@earendil-works/pi-ai": "^1.5.0",
+    "@earendil-works/pi-coding-agent": "^1.5.0",
+    "@earendil-works/pi-tui": "^1.5.0",
     "@sinclair/typebox": "^0.34.52"
   }
 }

package/src/batch-capture.test.ts

@@ -11,6 +11,26 @@ import {
 } from "./batch-capture.js";
 import type { CapturedBatch, CapturedToolCall } from "./types.js";
 import { ToolCallIndexer } from "./indexer.js";
+import { isProtected } from "./protected.js";
+import { DEFAULT_CONFIG } from "./types.js";
+
+test("nested protection uses each turn's first paired result and preserves capture metadata", () => {
+  const nestedCalls = { complete: true, calls: [{ id: "nested", name: "read", arguments: { path: "skills/x/SKILL.md" }, status: "ok" as const }] };
+  const assistant = { role: "assistant", content: [{ type: "toolCall", id: "same", name: "codemode", arguments: { code: "read()" } }] };
+  const result = (timestamp: number, nested?: typeof nestedCalls) => ({ role: "toolResult", toolCallId: "same", toolName: "codemode", timestamp, content: [{ type: "text", text: "body" }], ...(nested ? { nestedCalls: nested } : {}) });
+  const protectedResult = result(1, nestedCalls);
+  const plainResult = result(2);
+  const captured = captureBatch(assistant, [protectedResult, plainResult], 0, 0);
+  expect(captured.toolCalls[0].nestedCalls).toBe(nestedCalls);
+  expect(captureBatch(assistant, [plainResult], 1, 0).toolCalls[0]).not.toHaveProperty("nestedCalls");
+  expect(serializeBatchForSummarizer(captured)).not.toContain("nestedCalls");
+  const branch = [assistant, protectedResult, plainResult, assistant, plainResult].map(message => ({ type: "message", message }));
+  const batches = captureUnindexedBatchesFromSession(branch, { isSummarized: () => false },
+    (name, args, nested) => isProtected(name, args, DEFAULT_CONFIG, nested));
+  expect(batches).toHaveLength(1);
+  expect(batches[0].turnIndex).toBe(1);
+  expect(batches[0].toolCalls[0].resultTimestamp).toBe(2);
+});
 
 function toolCall(overrides: Partial<CapturedToolCall> = {}): CapturedToolCall {
   return {

package/src/batch-capture.ts

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
 import type { SessionEntry } from "@earendil-works/pi-coding-agent";
 import type { CapturedBatch, CapturedToolCall, BatchingMode } from "./types.js";
 import { occKey, resultTimestampOf } from "./occurrence-key.js";
@@ -111,6 +112,7 @@ export function captureBatch(
         resultText,
         isError,
         ...(resultTimestamp !== undefined ? { resultTimestamp } : {}),
+        ...(match?.nestedCalls !== undefined ? { nestedCalls: match.nestedCalls } : {}),
       } satisfies CapturedToolCall;
     });
 
@@ -128,7 +130,7 @@ export function captureBatch(
 export function captureUnindexedBatchesFromSession(
   branch: any[],
   indexer: { isSummarized(id: string): boolean },
-  exclude: (toolName: string, args: unknown) => boolean = () => false
+  exclude: (toolName: string, args: unknown, nested?: NestedToolCalls) => boolean = () => false
 ): CapturedBatch[] {
   // Keep the SessionEntry wrapper alongside each projected message so the
   // entry's own timestamp remains available as the preferred source below
@@ -191,7 +193,7 @@ export function captureUnindexedBatchesFromSession(
       const result = turnResults.get(id);
       if (!result) return false;
       if (indexer.isSummarized(occKey(id, resultTimestampOf(result.timestamp)))) return false;
-      if (exclude(tc.name, tc.input ?? tc.arguments)) return false;
+      if (exclude(tc.name, tc.input ?? tc.arguments, result.nestedCalls)) return false;
       return true;
     });
 

package/src/chain-detector.test.ts

@@ -1,5 +1,21 @@
 import { describe, expect, test } from "bun:test";
 import { detectChains, isChainAnchorCustom, withClosingMessage } from "./chain-detector.js";
+import { isProtected } from "./protected.js";
+import { DEFAULT_CONFIG } from "./types.js";
+
+test("nested protected reads join a closed chain's protected ids", () => {
+  const messages = [
+    userMsg(1),
+    { role: "assistant", timestamp: 2, content: [{ type: "toolCall", id: "script", name: "codemode", arguments: {} }] },
+    { role: "toolResult", timestamp: 3, toolCallId: "script", toolName: "codemode", nestedCalls: {
+      complete: true, calls: [{ id: "read", name: "read", arguments: { path: "skills/x/SKILL.md" }, status: "ok" }],
+    } },
+    { role: "assistant", timestamp: 4, content: [{ type: "text", text: "done" }] },
+  ];
+  const [chain] = detectChains(messages, (name, args, nested) => isProtected(name, args, DEFAULT_CONFIG, nested));
+  expect(chain.protectedToolCallIds).toEqual(["script"]);
+  expect(chain.finalAssistantTimestamp).toBe(4);
+});
 
 const custom = (customType: string, timestamp: number) => ({ role: "custom", customType, timestamp });
 

package/src/chain-detector.ts

@@ -1,3 +1,4 @@
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
 import { occKey, resultTimestampOf } from "./occurrence-key.js";
 import type { ChainRange } from "./types.js";
 
@@ -45,12 +46,12 @@ type State = "idle" | "inChain";
  * NOTE: Message identity uses `timestamp` (for user / final text-only assistant) and
  * `toolCallId` sets (for middle tool-using turns). AgentMessage has no `.id` field.
  *
- * @param isProtected  Predicate over (toolName, args); matching calls are never pruned
+ * @param isProtected  Predicate over (toolName, args, nestedCalls); matching calls are never pruned
  *                     and their outputs are relocated verbatim into compressed chains.
  */
 export function detectChains(
   messages: any[],
-  isProtected: (toolName: string, args: unknown) => boolean = () => false,
+  isProtected: (toolName: string, args: unknown, nested?: NestedToolCalls) => boolean = () => false,
 ): ChainRange[] {
   const ranges: ChainRange[] = [];
   let state: State = "idle";
@@ -108,9 +109,8 @@ export function detectChains(
       if (msg.toolCallId) {
         middleIds.add(msg.toolCallId);
         middleKeys.add(occKey(msg.toolCallId, resultTimestampOf(msg.timestamp)));
-        // toolResult fallback — results carry no args; name-only by design,
-        // the assistant block always precedes its result so no protection is lost
-        if (isProtected(msg.toolName, undefined)) protectedIds.add(msg.toolCallId);
+        // Outer args live on the assistant block; nested calls live on the result.
+        if (isProtected(msg.toolName, undefined, msg.nestedCalls)) protectedIds.add(msg.toolCallId);
       }
       continue;
     }

package/src/commands.test.ts

@@ -97,13 +97,14 @@ function setupPrunerCommand(overrides: {
   };
 }
 
-describe("/pruner settings argument purge", () => {
+describe("/pruner settings descriptions", () => {
   initTheme("dark");
 
   it.each([
     ["purgeErrorsEnabled", "Argument purge", "Shrink long strings in summarized calls when their results are stubbed in the same render, and in errored calls after the error cooldown, keeping argument shape."],
     ["purgeErrorsCooldown", "Error purge cooldown (turns)", "Wait this many turns after a tool error before purging its argument body."],
     ["purgeErrorsMinArgChars", "Argument purge min arg chars", "Only purge summarized or errored argument bodies at least this many chars."],
+    ["protectedPaths", "Protected paths", "reads made inside codemode scripts"],
   ])("describes %s through the settings overlay", async (id, label, description) => {
     const harness = setupPrunerCommand({ save: async () => {} });
     await harness.run("settings");
@@ -114,6 +115,11 @@ describe("/pruner settings argument purge", () => {
     expect(rendered).toContain(label);
     expect(rendered).toContain(description);
     if (id === "purgeErrorsCooldown") expect(rendered).not.toContain("same render");
+    if (id === "protectedPaths") {
+      expect(rendered).toContain("nestedCalls");
+      expect(rendered).toContain("incomplete nested-call record is kept verbatim regardless of this setting");
+      expect(rendered).toContain("Set to 'none' to disable path matching only");
+    }
   });
 
   it("persists the shared disabled toggle and minimum using only existing purgeErrors fields", async () => {

package/src/commands.ts

@@ -256,7 +256,7 @@ function protectedToolsDescription(config: ContextPruneConfig): string {
 }
 
 function protectedPathsDescription(config: ContextPruneConfig): string {
-  return `Glob patterns matched against a tool call's \`args.path\`; matching outputs are NEVER pruned. Currently: ${protectedToolsDisplay(config.protectedPaths)}. Edit via \`/pruner protected-paths\` (interactive) or \`/pruner protected-paths <comma-separated globs>\`. Set to 'none' to disable (kill switch). Default protects skill files and per-repo gauntlet overrides: **/skills/**/*.md, **/gauntlet-overrides.md`;
+  return `Glob patterns match a tool call's \`args.path\` and reads recorded in a result's \`nestedCalls\`, including reads made inside codemode scripts. Matching outputs bypass summarization. An incomplete nested-call record is kept verbatim regardless of this setting. Set to 'none' to disable path matching only. Currently: ${protectedToolsDisplay(config.protectedPaths)}. Edit via \`/pruner protected-paths\` (interactive) or \`/pruner protected-paths <comma-separated globs>\`. Default protects skill files and per-repo gauntlet overrides: **/skills/**/*.md, **/gauntlet-overrides.md`;
 }
 
 const HELP_TEXT = `pruner — automatically summarizes tool-call outputs to keep context lean.

package/src/context-metrics.test.ts

@@ -1,6 +1,16 @@
 import { describe, expect, test } from "bun:test";
 import { computeContextMetrics } from "./context-metrics.js";
-import type { PruneFrontier } from "./types.js";
+import { DEFAULT_CONFIG, type PruneFrontier } from "./types.js";
+import { isProtected } from "./protected.js";
+
+test("frontier gap excludes a result with a protected nested read", () => {
+  const messages = [userMsg(1), assistantWithTools(2, ["script"]), {
+    ...toolResult(3, "script", "codemode"),
+    nestedCalls: { complete: true, calls: [{ id: "nested", name: "read", arguments: { path: "skills/x/SKILL.md" }, status: "ok" }] },
+  }];
+  expect(computeContextMetrics(messages, null, () => false,
+    (name, args, nested) => isProtected(name, args, DEFAULT_CONFIG, nested)).frontierGapTokens).toBe(0);
+});
 
 // ── Minimal message factories (mirrors src/chain-detector.test.ts style) ───
 

package/src/context-metrics.ts

@@ -1,3 +1,4 @@
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
 import { detectChains, isChainAnchorCustom } from "./chain-detector.js";
 import { occKey, resultTimestampOf } from "./occurrence-key.js";
 import type { ContextMetricsSnapshot, PruneFrontier } from "./types.js";
@@ -49,7 +50,7 @@ export function computeContextMetrics(
   branch: any[],
   frontier: PruneFrontier | null,
   isSummarized: (occurrenceKey: string) => boolean,
-  isProtected: (toolName: string, args: unknown) => boolean,
+  isProtected: (toolName: string, args: unknown, nested?: NestedToolCalls) => boolean,
 ): ContextMetricsSnapshot {
   if (branch.length === 0) {
     return { openCycleThinkingTokens: 0, largestChainSharePct: 0, frontierGapTokens: 0 };
@@ -156,7 +157,7 @@ export function computeContextMetrics(
     const key = occKey(m.toolCallId, resultTimestampOf(m.timestamp));
     if (isSummarized(key)) continue;
     const args = findArgsForToolCallId(branch, i, m.toolCallId);
-    if (isProtected(m.toolName, args)) continue;
+    if (isProtected(m.toolName, args, m.nestedCalls)) continue;
     frontierGapTokens += tokensOf(m);
   }
 

package/src/protected.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
 import { globToRegExp, isProtected, normalizePath } from "./protected.js";
 import { DEFAULT_CONFIG } from "./types.js";
 
@@ -67,6 +68,46 @@ describe("isProtected", () => {
     expect(isProtected("read", { path: "/h/src/app.ts" }, cfg)).toBe(false);
   });
 
+  test.each(["ok", "error"] as const)("protects nested skill reads with status %s", (status) => {
+    expect(isProtected("codemode", { code: "console.log(await tools.read({ path: 'skills/x/SKILL.md' }))" }, cfg, {
+      complete: true,
+      calls: [{ id: "nested-read", name: "read", arguments: { path: "skills/x/SKILL.md" }, status }],
+    })).toBe(true);
+  });
+
+  test.each([undefined, {}, { path: "source.ts" }])("protects nested tool names with arguments %j and path matching disabled", (args) => {
+    for (const outerName of ["codemode", "another-script-tool"]) {
+      expect(isProtected(outerName, {}, { protectedTools: ["todowrite"], protectedPaths: [] }, {
+        complete: true, calls: [{ id: "nested", name: "todowrite", arguments: args, status: "ok" }],
+      })).toBe(true);
+    }
+  });
+
+  test.each([
+    { complete: false, calls: [] },
+    { complete: false, calls: [{ id: "write", name: "write", arguments: { path: "source.ts" }, status: "ok" }] },
+    { complete: false, calls: [{ id: "read", name: "read", argumentsBytes: 8193, status: "ok" }] },
+    { complete: false, calls: [{ id: "read", name: "read", arguments: { path: "source.ts" }, status: "unfinished" }] },
+  ] satisfies NestedToolCalls[])("protects incomplete records %j even with empty configuration", (nested) => {
+    for (const config of [cfg, { protectedTools: [], protectedPaths: [] }]) {
+      expect(isProtected("codemode", {}, config, nested)).toBe(true);
+    }
+  });
+
+  test.each([
+    undefined,
+    { complete: true, calls: [] },
+    { complete: true, calls: [{ id: "read", name: "read", arguments: { path: "source.ts" }, status: "ok" }] },
+    { complete: true, calls: [{ id: "read", name: "read", arguments: { path: 42 }, status: "ok" }] },
+    "malformed",
+    { complete: false, calls: {} },
+  ])("keeps unmatched or malformed nested records %j prunable without changing direct protection", (nested) => {
+    const record = nested as NestedToolCalls | undefined;
+    expect(isProtected("codemode", { code: "tools.read({path: 'skills/x/SKILL.md'})" }, cfg, record)).toBe(false);
+    expect(isProtected("todowrite", {}, cfg, record)).toBe(true);
+    expect(isProtected("read", { path: "skills/x/SKILL.md" }, cfg, record)).toBe(true);
+  });
+
   test("backslashes normalized to forward slashes", () => {
     expect(isProtected("read", { path: "h\\skills\\x\\SKILL.md" }, cfg)).toBe(true);
   });

package/src/protected.ts

@@ -1,3 +1,5 @@
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
+
 /** Structural pick of ContextPruneConfig — keeps this module dependency-free. */
 export interface ProtectionConfig {
   protectedTools: readonly string[];
@@ -46,7 +48,7 @@ export function normalizePath(path: string): string {
   return path.replace(/\\/g, "/");
 }
 
-export function isProtected(toolName: string, args: unknown, config: ProtectionConfig): boolean {
+function matches(toolName: string, args: unknown, config: ProtectionConfig): boolean {
   if (config.protectedTools.includes(toolName)) return true;
   if (config.protectedPaths.length === 0) return false;
   const path = (args as Record<string, unknown> | null | undefined)?.path;
@@ -54,3 +56,10 @@ export function isProtected(toolName: string, args: unknown, config: ProtectionC
   const normalized = normalizePath(path);
   return config.protectedPaths.some((p) => globToRegExp(p).test(normalized));
 }
+
+export function isProtected(toolName: string, args: unknown, config: ProtectionConfig, nested?: NestedToolCalls): boolean {
+  if (matches(toolName, args, config)) return true;
+  if (!nested || typeof nested !== "object" || !Array.isArray(nested.calls)) return false;
+  if (nested.complete === false) return true;
+  return nested.calls.some((call) => matches(call?.name, call?.arguments, config));
+}

package/src/pruner.test.ts

@@ -599,6 +599,27 @@ describe("render-time protection re-check", () => {
     expect(messages[1].content[0].text).toBe("FULL SKILL BODY");
   });
 
+  it("repairs an indexed script result from nested metadata with byte-identical repeat renders", () => {
+    const record = { toolCallId: "script", toolName: "codemode", args: { code: "read()" }, resultText: "FULL SKILL BODY", isError: false, turnIndex: 0, timestamp: 10 };
+    const oldIndexer = makeMockIndexer({
+      summarized: new Set(["script"]), shortRefs: new Map([["script", "t1"]]), records: new Map([["script", record]]),
+    });
+    const raw = [
+      { ...skillAsst, content: [{ type: "toolCall", id: "script", name: "codemode", arguments: record.args }] },
+      { ...skillMsg, toolCallId: "script", toolName: "codemode", nestedCalls: {
+        complete: true, calls: [{ id: "nested", name: "read", arguments: { path: "skills/x/SKILL.md" }, status: "ok" }],
+      } },
+    ];
+    const before = JSON.stringify(raw);
+    const render = () => pruneMessages(raw, oldIndexer as any, undefined, undefined,
+      { protectedTools: [], protectedPaths: ["**/skills/**/*.md"] });
+    const first = render();
+    expect(first.pruned).toBe(false);
+    expect(JSON.stringify(first.messages)).toBe(before);
+    expect(JSON.stringify(render().messages)).toBe(JSON.stringify(first.messages));
+    expect(oldIndexer.getRecord("script")).toBe(record);
+  });
+
   it("still stubs when no protection config is passed", () => {
     const { messages, pruned } = pruneMessages([skillAsst, skillMsg], indexer as any);
     expect(pruned).toBe(true);

package/src/pruner.ts

@@ -116,7 +116,7 @@ export function pruneMessages(
     // session JSONL, so skipping the stub restores it verbatim.
     // Dedup aliases resolve to the original record, so an alias whose own
     // path is protected but whose original isn't stays stubbed (edge case).
-    if (protection && record && isProtected(record.toolName, record.args, protection)) {
+    if (protection && record && isProtected(record.toolName, record.args, protection, msg.nestedCalls)) {
       return msg;
     }
     if (inGrace.has(key)) {

package/src/reload-rearm.integration.test.ts

@@ -3,6 +3,7 @@ import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { supersededStub } from "./supersede.js";
+import { DEFAULT_CONFIG } from "./types.js";
 
 // This must run before any module that transitively reads PI_CODING_AGENT_DIR
 // (src/config.ts's getAgentDir()) is imported/executed.
@@ -323,6 +324,47 @@ async function boot(options?: Parameters<typeof bootExtension>[0]) {
   return harness;
 }
 
+describe("nested protection capture", () => {
+  it.each([
+    { mode: "live", incomplete: false },
+    { mode: "rescan", incomplete: false },
+    { mode: "live", incomplete: true },
+    { mode: "rescan", incomplete: true },
+  ])("%j excludes protected script output from summarizer and index", async ({ mode, incomplete }) => {
+    const branch: any[] = [];
+    const { handlers, ctx, appended } = await boot({ branch, ...(incomplete ? { protectedPaths: [] } : {}) });
+    await handlers.get("session_start")!({}, ctx);
+    const message = { role: "assistant", content: [
+      { type: "toolCall", id: "script", name: "codemode", arguments: { code: "read()" } },
+      { type: "toolCall", id: "control", name: "read", arguments: { path: "source.ts" } },
+    ] };
+    const toolResults = [
+      { role: "toolResult", toolCallId: "script", toolName: "codemode", timestamp: 10, content: [{ type: "text", text: "PROTECTED-SCRIPT-BODY".repeat(incomplete ? Math.ceil(DEFAULT_CONFIG.spillThreshold / "PROTECTED-SCRIPT-BODY".length) + 1 : 200) }], nestedCalls: {
+        complete: !incomplete, calls: incomplete ? [] : [{ id: "nested", name: "read", arguments: { path: "skills/x/SKILL.md" }, status: "ok" }],
+      } },
+      { role: "toolResult", toolCallId: "control", toolName: "read", timestamp: 11, content: [{ type: "text", text: "UNPROTECTED-CONTROL".repeat(200) }] },
+    ];
+    branch.push(...[message, ...toolResults].map(message => ({ type: "message", message })));
+    ctx.getContextUsage = () => ({ tokens: 10, contextWindow: 1000000 });
+    const inputs: string[] = [];
+    const previousStream = streamImpl;
+    streamImpl = (_model, input) => { inputs.push(JSON.stringify(input)); return okStream(); };
+    try {
+      await handlers.get("turn_end")!({ message, toolResults, turnIndex: 0 }, ctx);
+      if (mode === "live") ctx.sessionManager.getBranch = () => { throw new Error("force pending live batch"); };
+      await handlers.get("message_end")!({ message: { role: "assistant", content: [{ type: "text", text: "done" }] } }, ctx);
+      expect(inputs).toHaveLength(1);
+      expect(inputs[0]).toContain("UNPROTECTED-CONTROL");
+      expect(inputs[0]).not.toContain("PROTECTED-SCRIPT-BODY");
+      const indexed = appended.filter(entry => entry.type === "context-prune-index")
+        .flatMap(entry => (entry.data as any).toolCalls.map((call: any) => call.toolCallId));
+      expect(indexed).toEqual(["control"]);
+    } finally {
+      streamImpl = previousStream;
+    }
+  });
+});
+
 describe("reload rearm (issue #6)", () => {
   it("hides the startup widget when the prune status line is disabled", async () => {
     const { handlers, ctx, widgets } = await boot({ showPruneStatusLine: false });
@@ -1735,3 +1777,53 @@ describe("session-wide live turn index (#16)", () => {
     expect((fm[0].data as any).trigger).toBe("frontier-gap");
   });
 });
+
+describe("final agent-message flush in sessions without a UI (#29)", () => {
+  const finalReply = { message: { role: "assistant", content: [{ type: "text", text: "done" }] } };
+
+  it("skips the message-end flush when ctx.hasUI is false", async () => {
+    const branch: any[] = [];
+    const { handlers, ctx, appended } = await boot({ branch, autoBudgetThreshold: null, budgetTurnDelta: null });
+    ctx.hasUI = false;
+    ctx.getContextUsage = () => ({ tokens: 10, contextWindow: 1000000 });
+    await handlers.get("session_start")!({}, ctx);
+    const callsBefore = summarizerCalls;
+
+    await fireTurn(handlers, ctx, branch, "tc-p", "p".repeat(800), 0);
+    await handlers.get("message_end")!(finalReply, ctx);
+
+    expect(summarizerCalls).toBe(callsBefore);
+    expect(appended.some((e) => e.type === "context-prune-flush-metrics")).toBe(false);
+    expect(appended.some((e) => e.type === "context-prune-summary")).toBe(false);
+  });
+
+  it("still flushes mid-prompt on the turn_end budget trigger when ctx.hasUI is false", async () => {
+    const branch: any[] = [];
+    const { handlers, ctx, appended } = await boot({ branch });
+    ctx.hasUI = false;
+    await handlers.get("session_start")!({}, ctx);
+
+    await fireTurn(handlers, ctx, branch, "tc-b", "b".repeat(800), 0);
+
+    const fm = appended.filter((e) => e.type === "context-prune-flush-metrics");
+    expect(fm.length).toBe(1);
+    expect((fm[0].data as any).trigger).toBe("budget");
+    expect((fm[0].data as any).outcome).toBe("summarized");
+  });
+
+  it("flushes on the final assistant message when ctx.hasUI is true", async () => {
+    const branch: any[] = [];
+    const { handlers, ctx, appended } = await boot({ branch, autoBudgetThreshold: null, budgetTurnDelta: null });
+    ctx.hasUI = true;
+    ctx.getContextUsage = () => ({ tokens: 10, contextWindow: 1000000 });
+    await handlers.get("session_start")!({}, ctx);
+
+    await fireTurn(handlers, ctx, branch, "tc-u", "u".repeat(800), 0);
+    await handlers.get("message_end")!(finalReply, ctx);
+
+    const fm = appended.filter((e) => e.type === "context-prune-flush-metrics");
+    expect(fm.length).toBe(1);
+    expect((fm[0].data as any).trigger).toBe("message-end");
+    expect((fm[0].data as any).outcome).toBe("summarized");
+  });
+});

package/src/summarizer.ts

@@ -11,7 +11,7 @@ import type {
 import { serializeBatchForSummarizer } from "./batch-capture.js";
 import { FallbackController, type FallbackTransition } from "./summarizer-fallback.js";
 
-const SYSTEM_PROMPT = `You are summarizing a batch of tool calls made by an AI coding assistant.
+export const SYSTEM_PROMPT = `You are summarizing a batch of tool calls made by an AI coding assistant.
 For each tool call provide:
 - Tool name and a one-sentence description of what it did
 - Key outcome, plus any file paths, identifiers, signatures, or error strings copied verbatim - never reword these
@@ -273,7 +273,7 @@ async function runOnce(
  * session model, and the controller stays sticky in fallback until a
  * per-cooldown probe of the primary succeeds.
  */
-async function runSummarization(
+export async function runSummarization(
   userMessage: string,
   config: ContextPruneConfig,
   ctx: ExtensionContext,

package/src/types.ts

@@ -1,3 +1,5 @@
+import type { NestedToolCalls } from "@earendil-works/pi-ai";
+
 /**
  * Shared types for the context-prune extension.
  *
@@ -597,6 +599,7 @@ export const DEFAULT_CONFIG: ContextPruneConfig = {
 
 /** A single tool call + its result as captured from turn_end */
 export interface CapturedToolCall {
+  nestedCalls?: NestedToolCalls;
   toolCallId: string;
   toolName: string;
   args: Record<string, unknown>;